No need to open Mac BookDo not tamper with apple warrantyLCD Display unlock code

This tool simulate USB key board from 0000-9999 to scan possible efi or iCloud code and display the code enter on LCD

Forgotten password ? locked out after Hard Drive failed ?This Tool process appox 180 code per hour, so if your lock code is 0999, it should find it after just under 5 hours.This solution will take up to 3 days ( appox 50 hours ) to scan all the number from 0000-9999 and Ideal for PC Workshop or DIYEasy to use plug and unlock

Suitable for above 2010 to 2016 models that use a 4 digit EFI BIOS Password. Pre 2010 model use 6 digits passcode and this device not support these as bruteforce can take years on a 6 digit code.This tool may unable to unlock if the EFI password is set before icloud lock.You may need to format your hard drive if you dont know the osx window user log-in codePlease dont be confused the EFI and User login screen

Video Demo how to use the Rebelsimcard EFI ICloud Brute for unlocker

About the Sensor |

There are various settings which the user should understand in order to get the best results.The sensor is on the rear of the device.This is a photo resistor which measures the light intensity directly in front of it.The device reads the sensor before and after the PIN attempt.

The difference between the two readings will trigger the device to pause depending on the sensitivity setting in the”Method->Set Sensor” menu.To disable the sensor set the sensitivity to zero.

If you get false readings increase the sensitivity.If the sensor is triggered the search will pause and the “CONTINUE” button will be displayed.Place the sensor over an area of the screen which changes on a successful entry.

About the Timings

There are three search settings Search UP: The search will start from the users selected start pin number and proceed upwards.Search Down: fairly obvious

These are also modified with an exponential increment.These searches will loop round 0000 9999 and stop where they started.Use PIN list: This will use a PIN frequency list.The most commonly used PINS are searched first. (1234,1111,0000,0101,5150,1104,1001,1113,1324,1127,1221,1222,9999,0001,0909,0007,1023,…)

These timings are set by default to be quite slow. The user should experiment to achieve the fastest timings for the target.This can drastically reduce the completion time.Many targets we have tested successfully at full speed.Watch the PIN attempts carefully to make sure that four digits are entered each time and match the device display.The numbers are sent to the target at the same time they appear on the screen.

About the Search Mode

There are two user modifiable Timer settings.The setting adjustments have an exponential increment to enable the user to zoom through the range.The “Attempt Delay” is the time the device will wait between the end of one PIN attempt and the start of the next.

The “Keypress time” is the average time the device will simulate the key being pressed on a keyboard.(average because there is a small random timing factor implemented to counteract potential anti-bruteforce security measures)

Run a fast search in a textpad to get the list of these numbers if you need them.If the user STOPs a search (for example to change the timings or sensor) the search will continue from where it was.To start from the beginning again the user will need to select the Method again in the menu.

Tips and Tricks |

You can use any standard USB A to B cable like those found on printers.

Firstly and most importantly.
You need to make sure that you are attacking the Firmware Lock Screen. Press Command + R when you power up the device.

Secondly
The device needs to sit on the screen so that the photo resistor is looking at the padlock Icon. I find it easiest to lie the laptop on its back with the screen pointing upwards. Place the device with the photo resistor over the padlock in a way that you can see the password box.

To find the fastest speed
The macbook will implement a delay after the first several attempts. Watch for when the four password circles clear. This is a when new attempt can start. Watch for when the device starts the new attempt. The new attempt should start exactly as the previous one clears. If there is a delay then speed up the “attempt delay”. If less than four password circles appear then slow down the “attempt delay”

Sensor
The sensor will show the screen brightness as a number up to 1024 followed by a number in [brackets] which is the change it has detected. Normally this change will be quite small (less than 4). But if the device is moved or the lighting changes alot then this number will be larger. When it trigers it will pause the program and you will need to press CONTINUE to carry on with the search. Adjust the sensitivity (make the number larger) if you get false trigers.

Is sometimes happens that the owner of the macbook sets a firmware password before setting the icloud pin. On this occasion the first lock will be in place and override the 4 digit pin lock for the firmware. Although it would be wise to set the Firmware Password before the device goes missing, few owners are aware of this option. I have read that removing and formatting the HDD before removing the lock will reset the locks to 6 digits. I have not tried this so I can not confirm it. Attacking a 6-digit lock with an 11 second delay can take up to four months. If the Bruteforce device completes its cycle and the macbook is still in the Firmware password screen then there is not a four digit PIN. If the device completes the cycle and the macbook is in the icloud lock screen then it has found the PIN but the sensitivity of the sensor was too high so it missed the change-over.

EFI iCloud LCD Smart USB Device Unlock MacBook PRO Air

Unlimited Unlock - No Limit how many Macbook you want to unlock !!! No need to open Mac Book.

locked out after Hard Drive failed ? This Tool process appox 180 code per hour, so if your lock code is 0999, it should find it after just under 5 hours.

This solution will take up to 3 days ( appox 50 hours ) to scan all the number from 0000-9999 and Ideal for PC Workshop or DIY Easy to use plug and unlock Easy to use

Remove 4 Digit unlock code

Unlimited Unlock - No Limit how many Macbook you want to unlock !!!

No need to open Mac BookDo not tamper with apple warrantyLCD Display unlock code

This tool simulate USB key board from 0000-9999 to scan possible efi or iCloud code and display the code enter on LCD

Forgotten password ? locked out after Hard Drive failed ?This Tool process appox 180 code per hour, so if your lock code is 0999, it should find it after just under 5 hours.This solution will take up to 3 days ( appox 50 hours ) to scan all the number from 0000-9999 and Ideal for PC Workshop or DIYEasy to use plug and unlock

Suitable for above 2010 to 2014 models that use a 4 digit EFI BIOS Password. Pre 2010 model use 6 digits passcode and this device not support these as bruteforce can take years on a 6 digit code.This tool may unable to unlock if the EFI password is set before icloud lock.You may need to format your hard drive if you dont know the osx window user log-in codePlease dont be confused the EFI and User login screen

Easy to use, 1) Hold option key ( option +R ) while turn on the Mac, the locked menu will display.2) Plug the tool to USB port and wait for 10 seconds,, it will started by it self , LCD will display the code enter.3) Once the device find correct code and unlock the EFI, the unlock code is display on the LCD ( +/- 3 digit )

The EFI lock is the screen with the padlock ( lock 1 screen in top left of image above), Once it is unlocked the screen will change to 4 small box ( lock 2 screen on top right of image) the iCloud lock screen, use the same unlock code found with lock 1 to unlock the iCloud lock.

The lock 3 is the user login, this password cannot be unlocked as this is not what this tool is designed for. , it could be letter and numbers, if you don't know, just format and reinstall OSX if you can recall it.

Note the Device will not stop even the screen is unlocked so use a camera to record the screen unless you use the light sensor option in which case the light sensor would detect the new screen of the OS loading when the 4 Digit pin is foundAt the time the screen change from lock 1 to lock 2, the device display for example 7860, you remove the device and restart mac holding command and r to get in to the lock 1 screen again, type manually 7860, 7861, 7859 7862 ......etc until it is unlock, this will be the unlock code, use this code in lock 2, the 4 small box screen to get past that.

You can use your iphone with free camera apps ( like lapse it ) to take 1 photo every few minute to help you watch the code if the light sensor is turned off when you start brute forcing.

After unlock please reset the NVRAM:

How to reset NVRAM after unlock.

Locate the following keys on the keyboard: Command , Option, P, and R. You will need to hold these keys down simultaneously.Turn on the computer.Press and hold the Command-Option-P-R keys before the grey screen appears.Hold the keys down until the computer restarts and you hear the start up sound for the second time.Release the keys.

Now you can use wifi recovery to install the OS or use the OSX recovery Disk

Before you install new Operating System, you need to wipe everything from the hard disk or else it could get icloud locked again.

Two way to fully format the hard disk.1) Remove the hard drive to do the format on another computer.

2) Start your mac from a bootdisk DVD or USB ( Why ? because Mac will not let you format the disk you are current using to startup )